Does the AI Act apply to companies that only use AI tools?

Partly, yes. Regulation (EU) 2024/1689 gives duties to deployers, meaning organisations that use AI systems in their work, not only to the providers who build them. Since 2 February 2025, Article 4 requires providers and deployers to take measures on the AI literacy of the staff who deal with AI systems; as amended in July 2026 by Regulation (EU) 2026/1744, it asks them to support that literacy without guaranteeing a specific level for each person. The practices banned under Article 5 have also applied since 2 February 2025. Further duties depend on the system's risk category and apply on later dates: a deployer of a high-risk system, for example in recruitment or credit decisions, has obligations on human oversight, monitoring and logs, and some uses carry transparency duties towards the people affected. Using a general chatbot for drafting text is at the light end. A practical start is an inventory of the AI systems you actually use and what you use them for, then training matched to that list. Check the details with legal counsel, because guidance is still being published.

Read next

← All 45 questions on AI use and AI securityAll topics